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SUMMARY 


A redundancy management strategy for a tetrad strap-down inertial system 
is described. Algorithms are developed that attempt to identify which sensor 
in a tetrad configuration has experienced a step failure. An algorithm is 
also described that provides a measure of the confidence with which the cor- 
rect identification has been made. Experimental results are presented from 
real-time tests conducted on a three-axis motion facility utilizing an ortho- 
skew tetrad strap-down inertial sensor package. The effects of prediction 
errors and of quantization on correct failure identification are discussed 
as well as an algorithm for detecting second failures through prediction. 

INTRODUCTION 


The use of skewed, redundant, strapped-down inertial sensors is a prom- 
ising, cost-effective approach for gaining improved reliability for on-board 
Inertial sensing systems in aircraft (ref, 1). It is only recently, however, 
that inertial sensors with adequate long-term calibration stability for these 
strap-down applications have become available. For example, the ring laser 
gyro, whose development started in the early 1960s, is available now in proto- 
type production and has been extensively flight tested. For "single thread" 
flight control, three-axis orthogonal (triad) sensing with such Instruments 
is required. By adding one more sensor whose axis Is skewed with respect to 
the orthogonal triad we obtain the potential for a fail-safe system in that 
any three of the four sensors are adequate to provide the necessary triad 
information. A system with four sensors will be called a "tetrad" system. 

To have a fail-safe (FS) capability, we need a means for detecting that a 
sensor has failed so that the whole system can be switched off-line. To have 
a fail-operational (F0) system we need a means of not only detecting that a 
failure has occurred, but also of isolating (i.e., identifying and removing 
from calculational dependence) the failed sensor before it can cause delete- 
rious effects in the flight control system. 

The primary objective of this study effort was to investigate the feasi- 
bility of identifying the failed sensor in a tetrad configured system. Pre- 
vious work (see refs. 2-5) was directed at the failed sensor detection problem 
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for free-inertial navigation applications and did not consider the possibility 
of identifying the failed sensor in a tetrad configuration. The material pre- 
sented in this paper includes the description of a tetrad sensor failure- 
detection algorithm and dual algorithms for Identifying the failed sensor, A 
confidence algorithm whose purpose is to exclude erroneous identifications is 
also described. The joint application of the detection, dual Identification, 
and confidence algorithms comprises the redundancy management strategy for a 
tetrad sensor system that is analyzed in this report. 

The experimental evaluation was limited to step-type failures. In this 
type of failure, the output of the instrument jumps by some value at the time 
of the failure and remains biased by this value thereafter. The step-failure 
model was adopted because of its simplicity. The ability of the algorithms 
to detect and identify sensors which have undergone a step failure is a nec- 
essary, but not sufficient, condition for their application to aircraft system 
implementation . 

The evaluation was limited to one particular tetrad configuration, the 
ortho-skew configuration shown in figure 1. One of the sensor axes is skewed, 
forming equal angles (about 54.735°) with each of the three othogonal axes. 
Failure detection and identification results presented in this paper are 
restricted to gyro failures. Accelerometer failure detection and isolation 
is entirely analogous to that for gyros. 


TETRAD FAILURE DETECTION, IDENTIFICATION, AND CONFIDENCE 

ALGORITHMS 


The failure-detection, identification, and confidence algorithms for the 
tetrad strap-down inertial sensor system must detect that a sensor failure has 
occurred, identify it without error, and remove it from the computational 
stream. The general strap-down tetrad sensor package includes four gyros and 
four accelerometers. The ortho-skew tetrad configuration used in this study 
has three mutually orthogonal sensors and one skewed sensor whose input axis 
is angularly equidistant from each of the mutually orthogonal sensor axes. 

The ensuing explains details of the redundancy management strategy used for 
the tetrad. 


Symbol and Variable Conventions 

The tetrad reference frame is orthonormal and corresponds physically to 
the edges of the box containing the tetrad Instrument package. The orthogonal 
sensors' input axes are (neglecting misalignments) parallel to the axes of the 
tetrad reference frame. The transformation of coordinates to the tetrad frame 
from the current body reference frame, in which the tetrad instrument package 
is mounted, will be denoted t T^ . 

Let U£ represent a unit vector along the input axis direction of the 
ith sensor. This vector will be denoted t u_^ when it is expressed in 
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tetrad-frame components and In the body frame (b u i “ b^**t u i) * 

tetrad-frame components of the four sensor axes are denoted by the 3x4 

matrix, t U. 
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The right-most equality is true only for the ortho-skew configuration. The 
angle n is the angle between the skewed sensor's (sensor No. 4) input axis 
and the axes of each of the orthogonal sensors. The body-frame components of 
the four sensor axes are: 


b U * <b u l b"2 b u 3 bV 



( 2 ) 


Any of the sensing-axis unit vectors can be written as a linear combination of 
the other three. In particular, 

u^ = au^ + (tog + . (3) 


Measurement Model 

The sensors considered in this paper are of the integrating type so that 
the output measurement is the Integral of the sensed input over the sampling 
time Interval, A . 


This output measurement is observed as counts where each count has the 
value q. In this paper, the equivalent gyro quantization q is 3.136 arc- 
seconds. Every measurement readout is an integer number of counts. A non- 
destructive readout is assumed, so that any remaining fraction of a count is 
not lost, but is added into the counts for the next time interval. 


A gyro whose sensing axis is u^. senses the component of angular velocity 
fj which lies along u^. More generally, the gyro's measured output is a 
scaled version of u^ • ft which includes bias, quantization, and other effects. 
The gyro measurement model adopted for this paper is 


A0 ± (t) 



fl + M. 


F)dt + 



A similar model for accelerometer measurements is 


( 4 ) 


Av^Ct) = 



F)dr + q ± 



(5) 


In these equations, the notation "{}" means "integer part of," 
bias, S ± is the product of u.^ and the sensor's scale factor, M i 


bi is 

is a 
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vector of mass-unbal ance coefficients, F is specific force, q 3 is quantization 
error, and r^ is random error. The quantities bi, Si and Mi are estimated 
for each sensor by a calibration procedure described in the appendix. The 
gyro measurements are used to estimate il and accelerometer measurements are 
used to estimate F. The generic notation adopted for the input vector to be 
estimated from the sensors is p; the generic notation adopted for the ith 
sensor's output is mi. 

The equation 

m i “ u i * /p-t (6) 

therefore illustrates, approximately, the relationship between the input, and 
sensor's output, m. 


Computation of Orthogonal Triad Equivalent Measurements 


In order for aircraft sensor measurements to be useful in aircraft navi- 
gation or control, they must first be transformed from the tetrad reference 
frame into equivalent orthogonal triad measurements relative to the aircraft 
body reference frame. When four sensors are thought to be operational (no 
failures yet detected), a least-squares procedure is used to effect the trans- 
formation. From equation (6) we have 


rnA 

" 2 | ■ b uT b />■<" < 7 > 
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where the lower left subscript, b, means "expressed in the body frame." The 
least-squares solution then becomes 

b/pdr . (bV T r lu i ' 2 V » 




Equation (8) holds for a general tetrad geometry. In the special geometry of 
the ortho-skew configuration, the following simplification results. 



4 


(9) 


b T ' I ]+ Y b u 4 [ m 4 * c ° 8 n(n l * m 2 * m 3 ) ] 


Combining 


;ind 


«e ■ m A - cos n(m. + m_ + m.,) 


cos n 

b u 4 " b r ( 008 n 
cos n 

/ 

into equation (9), the least-squares output vector may be written 

mj + (« 5 cos n)/2 

. T l f n 

bj 
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( 12 ) 


m 3 + (« 5 cos n)/2 


When a sensor failure has been detected and isolated, the mapping excludes the 
failed sensor. Denoting the unfailed sensor axes by uj, Uj, ug and corre- 
sponding measurements by mj, mj, m^, the general solution becomes 



( b G i b a j b“k> 



b ft( t“i t“j t“k> 



“ bT 1 ( t (Uj * u k )m 1 + t (u k x G i )mj -f t (u 1 x U j)m k )/(u 1 x Uj • u R ) (13) 

When the sensor geometry is restricted to the ortho-skew configuration and the 
failed sensor is removed, then the following simplification of (13) results: 
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Failure Detection by Parity Residual Sum Divergence 

A theoretical relationship exists for any tetrad configuration that 
relates the measurements from the four like sensors: 

m^ » mnij + Bm^ + ym^ (18) 

Equation (18), which follows from equations (3) and ( 6 ), states that the out- 
put of any sensor can be formulated as a linear combination of the outputs of 
the other three sensors. This relationship is called parity. The coefficients 
a, fj, y are called parity coefficients. They can be determined from the 
tetrad's geometrical configuration. For the ortho-skew configuration, 

a * 8 ■ y ■ cos n ■ 1//3 (19) 

More generally, 

- ( u | iij u^)”* u 4 (20) 



Equation (18) never strictly holds in practice, hence a tetrad parity 
residual, € 5 , is defined as follows: 

e ^ * m^ - anij - 6 m., - Ytn^ (21) 

Thus, C 5 is the difference between the observed 1114 and the 1)14 computed 
in equation (18). For a perfect system, <3 would always be zero in the 
absence of failures. Normal instrument errors and output quantization cause 
the parity residual to take on a small range of values in normal operation. 
When a failure occurs, the parity residual exceeds its normal range. Thus, 
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one can detect failures by monitoring £ 5 , In this study, the parity residual 
Is summed over a specified number of sequential data frames in order to detect 
small but persistent failures, These sequential data frames are colled "accu- 
mulation Interval for detection" or "detection window" and denoted by Tj. 

The detection threshold d is the tolerance on the parity sum, A failure is 
indicated when the magnitude of the parity sum exceeds the detection threshold. 


Failure condition: 



( 22 ) 


The detection threshold and the length of the detection window determine the 
level of step failure which can be detected. 

Figure 2 illustrates the failure detection procedure. The parity resid- 
ual is computed for each set of four sensor measurements and is summed over 
the appropriate number of frames (t^) for comparison with the detection 
threshold. Figure 2 shows a step change in the parity residual, such as 
might result from a sensor failure. The change in the parity residual is the 
product of the step-failure size and the parity coefficient corresponding to 
the failed sensor. The parity residual sum increases the magnitude as a 
result of the step change in the parity residual, then levels out because the 
parity residual is summed over only the most recent data frames. If the 

failure is severe enough to cause the parity residual sum to exceed the detec- 
tion threshold, the detection logic indicates a failure to the system. 

The measurements m^ used in the computation of the parity residual 
must be appropriately compensated for biases, scale factors, and other known 
effects, or else the parity residual sum will indicate false failures. The 
effect of misalignment errors on the parity residual is to cause the parity 
coefficients to be in error. The parity coefficients are computed from the 
best estimates of the orientations of the sensors, but the measurements will 
be made by the sensors in their actual orientations. The differences between 
the estimated and actual orientations are misalignment errors. The coeffi- 
cients, computed as in equation (19), depend on the orientations of all four 
sensors even though the coefficients multiply only three measurements in the 
parity residual. A bias-compensation error affects the parity residual in 
proportion to the coefficient it multiplies. That is, a bias error in sensor 
No. 4 contributes to the parity residual directly, while a bias error, 6 , in 
sensor No. 3 contributes -yb to the parity residual. Thus for the ortho- 
skew configuration, a bias error of one unit in sensor No. 4 is equivalent to 
a bias error of /3 units in any one of the other three sensors in its effect 

on the parity residual. Of course, if a bias error is too large relative to 

the detection threshold, it will cause a false failure indication. For 

example, if the estimated scale factor of sensor No. 2 is in_ error by s, the 

corresponding contribution to the parity residual will be -sgn^. As with 
biases, scale factor compensation errors can cause false alarms. Random 
measurement errors which have small means and variances relative to the quan- 
tization level will not significantly affect the parity sum. 

The detection of a failure in a tetrad inertial sensor unit is a simple 
operation of calculation of the parity sum from accumulation of the parity 
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residual. Wien the magnitude of the parity residual sum exceeds the preset 
detection threshold, a failure Is indicated. The minimum level of step error 
that can be detected is determined by the number of points in the parity 
residual sum and the size of the detection threshold. 


Falled-Sensor Identification Algorithms 

A tetrad strap-down Inertial system inherently possesses fall-safe 
capability by virtue of the failure-detection capability just discussed. 
Extension to fail-operational, fall-safe capability requires the following: 

1. A reliable algorithm for determining which instrument has failed 
when the failure-detection scheme indicates a failure. (The failure can then 
be removed fi*om usage in subsequent calculations.) 

2, An algorithm for detection of a failure in the three remaining 
instruments . 


3. A confidence algorithm to preclude the erroneous Identification of 
a good sensor rather than the faulty sensor. 


Two failed- tensor identification algorithms have been investigated, each 
using measurement prediction in their computations. These algorithms, called 
the j-aeudosensor (PS) algorithm and the constrained-fit (CF) algorithm, are 
applied jointly to determine which sensor has failed. 


Pseudosensor algorithm — If a fifth sensor of each type were available 
(i.e. , a pentad configuration) each of five parity residual equations could 
combine the measurements of four sensors and exclude one sensor. Thus, extra 
parity residual equations would be used to identify the faulty sensor. If 
is the parity residual excluding m^, the parity residual equations would be 
of the form: 
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(23) 


The equation for ej excludes 1115 and may be recognized as the tetrad parity 
residual defined earlier in equation (21) . Pentad (five-sensor) failure 
identification utilizes the five parity residuals, If sensor i fails, 

will be smaller than any of the other parity residuals because m^, the 
measurement which is in error due to the failure, enters each of the pentad 
parity residual equations except the equation for . Sensor I is thus 
identified as the failed sensor. 
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In the pseudosensor algorithm a fifth sensor Is assumed whose predicted 
output, mt,, is used in the first fo.r pentad parity residual equations to 
identify the failed sensor. Correct identification is limited by the ability 
to predict m^. The fifth parity residual is used only for detection because 
it is the only parity residual computed from independent sensor outputs. 

In the absence of failures (i.e., prior to the detection of a failure in 
the tetrad configuration), the pseudosensor's output, IP 5 , may be computed 
from the measurements of the four real sensors: 

m 5 * b u 5 ’ b/P dT 

- c 51 mj + c 52 n» 2 ♦ c 53 m 3 + c J4 n> 4 (24) 

The coefficients in equation (24) are defined by the geometry of the sensing 
axes of the real sensors and the sensing axis (i.e., 1 , 05 ) chosen for the 
pseudosensor. 

( c 51 c 52 c 53 c 54) * b u 5(b U b^ ) b U (25) 

When a failure is detected, stored past values of m^ are used in a least- 
squares fit to obtain polynomial coefficients with which to predict m^. 

®5 U) " b 50 * b 51 (t * t 0 ) + b 52 (t " C 0 >2 + **• + b 5p (t ' C 0 )P (26) 

The least-squares fit should be based on recent data, but should not 
include data taken after the failure occurred. The exact time of the failure 
is sometimes difficult cr impossible to ascertain. The apparent time of fail- 
ure can be inferred by summing the parity residual backwards from the time of 
failure detection until this sum exceeds a present tolerance level; the 
most recent parity residual is added to the next most recent, etc. This 
process requires either that the past individual parity residuals or past 
sensor readings be stored in the computer. The numler of points required for 
the backward sum to exceed the preset threshold level indicates the apparent 
time of failure relative to the point of detection. ihe interval of time be- 
tween the apparent time of failure and the time of detection is the isolation 
interval for identification, Tj. The detection window t . is greater than or 
equal to the number of points in the backward sum; otherwise, the failure 
would not have been detected in Tj. The length, Tf, of the fit interval and 
the polynomial order of the fit were chosen experimentally for this paper to 
optimize failure isolation success. 

Using data from the fit interval to predict the output of the pseudosen- 
sor in the isolation interval tj, the first four pentad parity residuals, 
equation (23), are evaluated. These residuals are summed across and the 

smallest sum in magnitude is identified as corresponding to the failed sensor. 
Figure 3 illustrates the pseudosensor algorithm. 
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The situation shown in figure 3 Is for a failure of sensor No. 3. The 
failure is detected at time tj. The apparent time of failure is shown as 
four frames earlier, or t^-AA. Pseudosensor fit coefficients are computed 
in the fit interval T£ which Includes the fit reference time, to. The four 
paeudosensor parity residuals, €j_, are summed across the isolation interval, 
Tj_. The failure causes three of these sums to diverge more dramatically from 
zero than does E € 3 ; £€3 exhibits some divergence, primarily because of pre- 
diction error. The rate of divergence of each of the other parity residual 
sums is approximately proportional to the failure level times the parity coef- 
ficient (eq. (23)) which multiplies m 3 . The prediction error enters each 
parity residual sum equally, but may tend to reduce certain sums more than 
others because of sign differences in failure-induced divergence. 

In summary, the pseudosensor algorithm: 

1. Sums the tetrad parity residual, € 5 , backward from th; time of detec- 
tion to determine the apparent point of failure and the length of the isola- 
tion interval for identification, 

2. Uses stored mg data computed from equation (24) to calculate 
coefficients of a polynomial (26) for the estimated pseudosensor output for 
use in the isolation interval 

3. Extrapolates the polynomial to obtain predicted values of 015 to be 
used in the pseudosensor parity residual sum equations (23) in the isolation 
Interval 


4. Evaluates and integrates the pseudosensor parity residual sums, 

(i = 1 , 2 , 3 , 4 ) over identifying the failed sensor as the one whose 

parity residual sum is smallest in absolute value 

The ability of the pseudosensor algorithm to correctly identify the 
failed sensor is limited by the ability to predict the output of the pseudo- 
sensor across the isolation interval for identification, T 2 p. The tendency 
of prediction errors to grow restricts the length of Tp. Prediction errors 
will cause the four pseudosensor parity sums, Eep through ££ 4 , to diverge 
from zero, even in the absence of failures, making faulted-sensor identifica- 
tion difficult. If the prediction errors are adequately minimized, then one 
of the parity residual sums (£€3 in fig. 3) will not diverge as rapidly as 
the others, thus making falled-sensor identification possible. The pseudo- 
sensor parity coefficients, apj in equation (23), are geometry-dependent. 

They are derived similarly to the tetrad parity coefficients, equation (20), 
except that the pseudosensing axis, b u 5 > enters their definition while one of 
the actual tetrad axes is excluded. The pseudosensor's axis must not be 
parallel to any tetrad axis or in the plane of any two tetrad axes. For 
example, if the aircraft's yaw axis is chosen for the pseudosensor from con- 
sideration of smoothness and predictability, the ortho-skew tetrad frame must 
be rotated away from the body (i.e., aircraft) frame. 

The numerical values of the pseudosensor parity coefficients depend on 
the tetrad configuration as well as the relative orientation of the pseudosen- 
sor. It is desirable that all the coefficients ay be approximately equal 
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In magnitude (for equitable identification because of the dependence of parity 
residual-sum divergence rate on these coefficients). An optimal orientation 
of the ortho-skew tetrad frame (i.e., optimal ^I't) was derived for which the 
largest xatlo of any two coefficients was about 3.3. The pseudosensor algo- 
rithm is therefore unavoidably biased toward selecting some sensors as failed 
over others because the parity residual- sum divergence rates differ for the 
same failure level. 

Constrained-fit algorithm — The basic idea behind the constrained-fit 
algorithm is that the measurement residual (i.e., difference between a sensor's 
observed and predicted measurements in the isolation interval, T£, will be 
greater for the failed sensor than for any of the unfailed sensors. This 
strategy, therefore, also requires prediction of sensor output readings in 
the isolation interval. Data points in the fit Interval tj are used in a 
constrained polynomial fit for each sensor. The constraint Imposed on the 
polynomial fitting procedure is that the polynomials must obey the parity 
equation (18) at all times. The fit constraint helps to smooth out noise and 
quantization error in the individual sensor measurements which might corrupt 
an unconstrained fit to the measurements. The fit constraint also tends to 
outweigh the effects of failed data which may lie in the fit interval because 
three unfailed sensors "out-vote" the failed sensor through the constraint. 

The apparent point of failure and the isolation Interval are determined by 
summing the parity residual backward from the point of detection as in the 
pseudosensor algorithm. . The fit interval ends at the point before the isola- 
tion interval begins. 

The predicted measurement of the ith sensor at time t is given by 

"^(t) = b ±0 + b ±1 (t-t Q ) + b i2 (t-t Q ) 2 + ... + b ip (t-t Q )P (27) 

where the coefficients b^j are evaluated from measured sensor data in the 
fit interval. Equations for the bj_j will be presented later. Equation (27) 
is used to predict each sensor's output in the isolation Interval. The resid- 
uals 6 jL , which correspond to the difference between the actual sensor output 
in the isolation interval and that predicted by the polynomial coefficients 

5 i = m ± (t) - m ± (t) (28) 

are summed across x-j., leading co a largest (absolute) sum for one of the 
sensors. The largest residual sum identifies the failed sensor. 

Figure A illustrates the constrained-fit algorithm. The measurement 
residual sums, £5^, ate shown as functions of time in the isolation interval, 
t-j_. Three of these sums wander away from zero as a result of prediction 
errors. The fourth, that of sensor No, 3, is shown to diverge more rapidly 
away from zero. As with the pseudosensor algorithm, prediction errors can 
mask the divergence of relatively small failures and cause mistakes in iden- 
tification of the failed sensor. 
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The constrained fit is a least-squares polynomial fit for which the co- 
efficients obey a linear constraint. The constrained polynomial obeys the 
cond i t ion 


m^ft) - aiij ( t ) + tfm 2 (t) + ( t ) 


(29) 


for t in the fit interval and in the isolation Interval. Equation (29) is 
the tetrad measurement parity equation. The factors a, H and y are the 
tetrad parity coefficients. Equation (29) conditions the coefficients of each 
order as shown in equation (30). 



ab, . + 6b., . + yb 


1J 


2J 


3j 


(30) 


This condition reduces the problem to finding bjj for i-1,2,3 rather than 
for i-1,2,3,4. Equation (27) may be written in matrix form as shown in equa- 
tion (31) , 

m(x) - H(t)B (31) 

where 


m(x) 


/nij (t)\ 

I m 2 ^ T) | 

I m 3 fx) I 

\ m 4 (T) / 


(32) 


H(x ) 



0 0 T 
10 0 
0 1 0 
6 Y ax 


0 

x 

0 

8x 


0 x2 

0 0 

x 0 

yx ax^ 



(33) 


and where x ■ t - to* 



( 34 ) 
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The fit Interval Is divided into n equal-length segments, each of 
length A, (nA*Xf). Recent measurements from _ ie four sensors, having been 
stored previously, are available for use In the fit. A four-vector, m(x), 
whose elements are the four real measurements at t, is defined analogously 
to equation (32). A measurement residual vector, Y, is defined by equa- 
tion (35). 


m(A) - m(A)' 
m(2A) - m(2A) 


ini(nA) - m(nA), 


m(2A) 
, m(nA) 



(35) 


where m(x) is the actual sensor output and m(x) is the estimated output com- 
puted in the fit interval, if. A least-squares fit minimizes Y^Y by opti- 
mizing in the fit interval, which is the objective of the constrained-fit 
strategy. The matrix solution for B is 


where 



(36) 


(37) 


and H(x) was defined in equation (33). 

The polynomial coefficients, B, computed by equation (36), are used in 
equation (27) to predict the estimated sensor output, mj , in the isolation 
interval, xj. The residual between the actual sensor output and the estimated 
sensor output is computed as in equation (28), then summed across xj. 

The matrix, G, defined by equation (37), is a (An x 3p) matrix, where p 
is the order of the polynomial and n is the number of points in the fit 
interval; G^G is a (3p x 3p) matrix which must be inverted to compute B. It 
can be shown that the more convenient computational solution, 

B - P-1C (38) 

holds, where P“1 is the inverse of the symmetric (p+1) x (p+1) matrix, 
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p 



A2n2 

A 3 Ei 3 


A 3 Ei 3 

A 4 Ei 4 


(39) 


In which the indicated summations are for 1 ■ 1,2,..., n. The vector, C, in 
equation (38) is 3(p+l) - dimensional. Its elements, c-1 , are 3-d imensional 
vectors defined by 


c 


j 


r E(iA) J m <iA)~ 
E(iA) i m 2 (iA) 
:(iA) J m j (iA), 



(40) 


where e^fiA) is the tetrad parity residual at time iA relative to the fit 
reference. 


Detection of Second Failures 

Once a failure has been detected and the failed sensor identified, there 
are only three operational sensors remaining. Some mechanization is required 
for detecting a failure in one of the remaining sensors if the once-failed 
system is to be fail-safe. An adaptation of the pseudosensor algorithm 
scheme can be used to fill this need. A pseudosensor measurement is gener- 
ated from the measurements of the three unfailed sensors at each time-point 
following detection and isolation of the first failure. 

m 5 - c' i m i + c'jmj + (41) 

A recursive least-squares fit can be implemented to predict mj, using recent- 
past data over a specified interval which does not include the current point, 
in a manner similar to the generation of m 5 with four good sensors. 

m 5 (T) - b^g + b^T + b^T 2 +••• + b 5p lP ( 4 2) 

The b^j are computed by a least-squares fit to recent-past values of 1115 . A 
failure is indicated whan the magnitude of the pseudoresidual, 65 , defined by 

6^ * m^ - m^ (43) 

exceeds a preset tolerance. If a second failure is not indicated, the current 
measurements are used to update the polynomial coefficients b 5 j for the next 
time frame. This algorithm can only be valid when the aircraft's motion is 
smooth enough to be predictable in the near term. 


Confidence Algorithm 


The operation of the pseudosensor and the constrained-fit identification 
algorithms is subject to Incorrect solution for small failures and for large 
failures in conjunction with large amplitude high-frequency angular motion, 
such as may occur in abrupt turns or in severe turbulence. For this reason, 
a confidence algorithm was developed to test and reject these incorrect solu- 
tions. It is better to only indicate the presence of a failure than to 
identify a good sensor as a bad one and leave faulty data in the computational 
process. That is, the effects of small failures in one sensor of a tetrad 
inertial sensing unit are reduced (see eqs. (8) and (12)) in their influence 
on the triad output by the three good sensors, but if good data are removed 
by mistake, the faulty data have increased influence (see eqs. (13) through 
(17)) on the output. The indication of an unidentified failed sensor can show 
that the system's performance will be degraded. (The tetrad for these small 
failures has only an FS capability.) 

A confidence algorithm with 12 confidence measures was developed to judge 
the validity of the faulty sensor identification solution. These measures 
evaluate such questions as "How decisive is the solution, as judged by the 
pseudosensor parity residual sums?", "How good is the fit as judged by the fit 
residuals?" or "Do the pseudosensor and constrained-fit algorithm outputs 
agree?". These confidence measures, which are somewhat empirical in origin 
and derivation, often overlap each other in the nature of their tests. The 
12 measures will be described, together with a mathematical statement of each 
test. Definitions of variables used in the tests will be found in the nota- 
tion section. 


Confidence measure No. 1 — The isolation interval must be short. In 
other words, detection must be immediate. Not only are sharp failures more 
likely to be correctly identified because of the implied failure size, but 
short prediction intervals aid in successful identification as well. 


N < X ± (44) 

Confidence measure No. 2 — The apparent failure level must be large. 
Failure identification success improves when the failure is a high multiple 
of the failure-free parity residual noise level. 


e 5 /Op > A 2 


(45) 


Confidence measure No. 3 — The apparent failure level must be large in 
comparison with the pseudosensor fit residual. Fit errors usually lead to 
prediction errors, but are not critical to the solution if the failure is 
sharp enough. 


■J a K 


I/' 


r 5 > A 3 


(46) 


Confidence measure No. 4 — The pseudosensor algorithm's outcome must be 
decisive. The pseudosensor algorithm determination of failure is based on 
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comparison among four parity residual sums. The smallest sum identifies the 
faulty sensor, but in marginal cases, the smallest sum may not differ very 
much from the next smallest sum. If the prediction error is small and the 
failure level is large, however, the smallest pseudosensor parity residual 
sum will be decisively smaller than the next smallest. 

E£ „ s A‘min| * <"> 

Confidence measure No. 5 — The apparent failure level must be much larger 
than the apparent pseudosensor prediction error. The apparent prediction 
error is the value of the smallest parity residual in the isolation interval. 

> \ 5 (48) 


/% / z 


Confidence measure No. 6 — The ms pseudosensor fit residual must be 
small. This measure is an absolute test of goodness-of-fit , normalized by the 
rms parity residual but not compared against apparent failure size. 

r 5 / a p < A 6 (49) 


Confidence measure No. 7 — The apparent failure must be large in compari- 
son to the largest constrained-fit rms fit residual. This measure is analo- 
gous to confidence measure No. 3, but for the constrained-fit strategy rather 
than for the pseudosensor strategy. 


5 /«k c /max(o f ) > A ? 


(50) 


Confidence measure No. 8 — The constrained-fit outcome must be decisive. 
This measure is analogous to measure No. 4. 


26 

max 


/ E6 


nl 


> A g 


(51) 


Confidence measure No. 9 — The maximum apparent constrained-fit predic- 
tion error must be small compared to the apparent failure level. This measure 
is analogous to measure No. 5. 


V a kJ/ max (°i) > 


(52) 


Confidence measure No. 10 — The apparently failed sensor's measurement 
residual in the isolation interval must be large. This measure overlaps 
measure No. 2 somewhat. 

V a5 »a>> 2 - [«»*(«i)] 2 / > x 10 <53) 
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Confidence measure No. 11 — The rms constrained-fit residuals in the fit 
interval must be small. This measure, like measure No, 6, is an absolute test 
of goodness-of-fit, normalized but not compared with apparent failure size. 


max(o f )/o p < X U 


(54) 


Confidence measure No. 12 — The answers obtained by the two identifica- 
tion algorithms must agree. 


k 


c 


k 


P 


(55) 


Confidence measures No. 1 and No. 2 are independent of the identification 
algorithms. These measures assess the size of the failure and the rapidity 
by which it was apparently detected. (A ramp-type failure is more difficult 
to isolate.) Confidence measures Nos. 3 through 6 evaluate how believable the 
pseudosensor solution is. Confidence measures Nos. 7 through 11 evaluate the 
reliability of the solution for the constrained-fit algorithm. Confidence 
measure No. 12 compares the results of the two algorithms. 

If any of the confidence measures are not satisfied by the computational 
tests, the identification solution is rejected and the system reverts to a 
fail-safe-only classification. The must be determined for the particular 

tetrad system under consideration, and determined such that no incorrect solu- 
tions will be accepted while very few correct solutions are rejected. 


ASSESSMENT OF TETRAD FAILURE DETECTION, IDENTIFICATION, 
AND CONFIDENCE ALGORITHMS 


Sensor Failures 

The failure detection, identification, and confidence algorithms were 
tested using prerecorded experimental data (appendix) consisting of step 
failures introduced in the sensor outputs. As stated in the introduction, 
the ability of the identification algorithms to identify step failures is a 
necessary, but not sufficient condition, for flight control application. The 
failure step size was varied between 367°/hr and 4900°/hr. These step failures 
were inserted in four different test data regions which included simultaneous 
ramp and sinusoidal motion on different orthogonal axes. These experimental 
data are described in the appendix. 


Sensor Response Prediction 

The success of a possible tetrad FO-FS strategy depends on accurate pre- 
diction of the outputs of the individual sensors (constrained fit) and of the 
fifth sensor (pseudosensor) in the isolation interval from sensor data col- 
lected in the fit interval. Because of unpredictable aircraft motions, the 
predictions always contain errors. These errors can lead to an erroneous 
faulted sensor identification. The prediction error generally increases with 
increasing lengths of isolation (prediction) interval. 
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Tills error function Is Illustrated In figure 5, which shows the rms pre- 
diction error of the fifth sensor (the pseudosensor) as a function of isola- 
tion interval (i.e. , prediction length). The figure displays the rms value 
of 80 samples of (1115 - mg) predicted one frame, two frames, ..., ten frames. 
The 80 samples were obtained by fitting five points to a straight line, where 
the fit reference point, to, was takPn at each of 80 sequential pointB. 

Practical judgments were required in setting the polynomial fit order and 
length of the fit interval for this experimental evaluation. Thresholds for 
failure detection and confidence measures must also be selected while con- 
sidering the nature of the sensor data. Selection of fit order and the num- 
ber of fit points depends on the frequency of the motion and the measurement 
sampling frequency as well as on the sensor quantization and noise levels. 

The experimental data were sampled every 0.128 sec (about 8 Hz). Gyro quan- 
tization was 24.5°/hr per count (bit) per data frame. The rms parity residual 
noise in the four regions varied from 1.5 to 2.0 counts per data frame. Ranges 
of fit order and fit interval length were tested to determine optimum values 
for this experimental evaluation. Fit orders 0, 1, and 2 were tried, along 
with 3, 5, and 7 points in the fit interval. 

Table 1 presents the number of successful faulted-sensor identifications 
obtained from 2560 cases. The 2560 cases were made up of 80 time points, 8 - 
step failures at each time point and for four different sensors. The 8 -step 
failures ranged from 40 counts per data frame (980°/hr) to 180 counts per 
data frame (44lO°/hr). Table 1 indicates that fits of order 1 (i.e., straight 
line) to three data points in the fit interval gave the best faulted-sensor 
isolation success for the cases tested. Table 2 presents the information of 
table 1 in percentages. Relative success of the straight-line fits to three 
or five data points is explained by the vehicle motion in the evaluation. 

Its frequency was higher than the measurement sampling frequency (8 samples/ 
second) so that only a few data frames (e.g., 3 or 5) could be used in the fit 
interval. The motion was sufficiently time-variant that a zero-order fit was 
Inadequate. Quantization of the sensor output and sensor measurement noise 
cause fitting mistakes for second-order and higher-order fits. 


TABLE 1. - NUMBER OF SUCCESSFUL FAULTED-SENSOR 
IDENTIFICATIONS vs FIT ORDER AND FIT INTERVAL 


Data frames in 
fit interval 

Fit order 

0 

1 

2 

3 

1728 

2220 

1792 

5 

1553 

2130 

2032 

7 

1783 

2053 

2016 
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TABLE 2. - PERCENT SUCCESSFUL FAULTED SENSOR 
IDENTIFICATIONS vs FIT ORDER AND FIT INTERVAL 


Data frames in 
fit interval 

Fit order 

0 

1 

2 

3 

67.5% 

86.7% 

70.0% 

5 

60.7% 

83.2% 

79.4% 

7 

54.0% 

80.2% 

78.8% 


The necessity for a good fit decreases as the failure level increases 
because the effect of fitting and prediction errors becomes relatively less 
influential on the outcome of the isolation strategies. Results in tables 1 
and 2 indicate trends. These trends were used to select the polynomial fit 
Order and the length of the fit interval for the detailed evaluation of the 
strategies. The three-point fit interval and first-order fit were shown to 
be the best fit (86.7% successful) for this case, but a five-point, first- 
order fit (83.2% successful) was chosen for later studies because the confi- 
dence measures for the five-point fit were slightly superior to those for the 
three-point fit. 

A failure is indicated when the moving-window sum of the parity residuals 
equals or exceeds the threshold. For example, if the detection threshold was 
set at 980°/hr, then a step failure of 245°/hr in sensor No. 4 would cause a 
failure indication in four data frames (i.e., (4) (245°/hr) = 980°/hr). This 
detection threshold must be high enough to exclude "false alarms" yet low 
enough to trigger on minimum failures. Much smaller failures can be detected 
than one could expect to correctly Isolate (i.e., identify) in a tetrad instru- 
ment package. Figure 6 indicates the number of frames required to exceed a 
preset detection threshold of 980°/hr for various step-failure levels. The 
data are presented for detection Intervals from 1 to 10 data frames. Eighty 
test cases were run for each step-failure level. For example (refer to 
fig. 6), 80 different 200°/hr step failures were Imposed on gyro No, 1 and a 
detection of these simulated failures occurred 15 times in the seventh frame 
following failure, 51 times In the eighth frame and 14 times in the ninth 
frame (for a total of 80) . Similar failures are detected more rapidly in 
gyro No. 4 under the same conditions because of its larger coefficient (weight- 
ing factor) in the parity residual. 


Confidence Algorithms Constants 

The identification confidence measures (CM) require numerical constants 
in order to execute the algorithm for accepting or rejecting the decisions 
made by the pseudosensor and constrained-fit algorithms. The numerical con- 
stants are strongly related to the character of the experimental data. 
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Considerable computer processing of different values for the numerical con- 
stants (using the same experimental sensor data) was done to select the best 
values to be used in this study. The primary constraint used in selecting 
the numerical constants was that no false identifications be accepted by the 
confidence algorithm. Practical considerations led to the numerical values 
(thresholds) used in the confidence measures and shown in table 3. These 
values are not optimized, but represent the best performance that could be 
obtained during the study. 

TABLE 3. - CONFIDENCE THRESHOLDS, \ ± 


i 

X i 

1 

*i 

1 

4 

7 

4 

2 

20 

8 

2 

3 

6 

9 

3 

4 

2 

10 

30 

5 

4 

11 

3 

6 

3 




Performance Summary 


There are four possible outcomes of the two faulted-sensor identification 
algorithms in connection with simulated failures. These four outcomes are: 

(Y) Successful identification of the faulted sensor and acceptance of 
the solution 

(N) Unsuccessful identification of the faulted sensor and rejection of 
the solution 

(R) Successful identification of the faulted sensor and rejection of 
the solution 

(U) Unsuccessful identification of the faulted sensor and acceptance of 
the solution. 

The objectives of the tetrad strategy are to maximize the number of 
successful, accepted (Y) cases, minimize the number of unsuccessful (N) or 
rejected (R) cases, and have no unsuccessful-but-accepted (U) cases. The 
experimental results summarizing the performance are shown in table 4. These 
results illustrate the experimental performance of the tetrad strategy for 
simulated step failures. For step errors of 2940°/hr or greater, the isola- 
tion interval is one and the (Y) percentage of total cases is greater than 
80%. For step errors smaller than 2940°/hr the isolation intervals are often 
greater than one data frame. The number of (N) and (R) cases also increases 
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TABLE a, - PERFORMANCE SUMMARY OF TETRAD FO-1'S REDUNDANCY MAh. (CEMENT STRATEGY 



,J FD1 >= 1th d.i t (i frame In isolation Interval 

l V u successful and confidence measures accept decision {Z of 320 samples) 
l h « unsuccessful and confidence measures reject decision (" of 320 samples) 
ll R o nucecHiiful but confidence measures reject deetsion ("’ of 320 samples) 
c r n unsuccessful but confidence measures accept decision (% of 320 samples) 
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until, for failures smaller than 980°/hr, all cases are either (N) or (R) . 

The results from table 4 are presented graphically in figures 7 and 8. Fig- 
ure 7 shows the percentage of successful isolations (Y+R outcomes) and the 
percentage of successful-nnd-accepted isolations (Y outcomes only), versus 
failure level, without regard for the number of frames required to detect the 
failure. Figure 8 shows three histograms representing horizontal samples of 
the data from table 4. Each histogram pertains to a particular failure level 
(490°/hr, 980°/hr, and l960°/hr arc shown). A bar is shown for each frame. 

The total height of the bar at each frame is the percentage of cases detected 
in that frame. Each bar may contain "N", M R" and "Y" segments. In the histo- 
gram for 19G0°/hr step failures, for example, nearly 97% of the failures were 
detected in one frame and about 85% of these were successfully isolated, 
although only about 36% were accepted. The other bars may be similarly inter- 
preted. The tetrad strategy detected and accepted 100% of all step-failures 
larger than 44l0°/hr and no unsuccessful solutions were uccepted for the fit 
order and fit intervals chosen for this detailed study. 

It is significant that no cases of type (U) occur, even for small fail- 
ures. The confidence algorithm precludes an error In failed-sensor identifi- 
cation, but it also causes rejection of many successful isolations. These 
are shown in table 4 as (R)-type cases. The penalty for excluding all (U)-type 
cases is illustrated in figure 7, which shows the divergence between unquali- 
fied successful identifications and successful identifications accepted by the 
12 confidence-measure algorithms. Relaxing the confidence-measure thresholds 
to accept more successful identifications will increase the likelihood of 
accepting wrong identifications unless the confidence algorithms are Improved, 

The percentage of (Y) cases can be increased by decreasing the quantiza- 
tion level, while increasing the quantization level degrades the isolation 
performance. This is shown in figure 9, the input data for which was simu- 
lated and noise-free. The practical value of the quantization level, q, is 
approximately 1.6 arcsec/count — a level currently available in laser gyros. 

The 99% confidently identifiable step-type failure at a 1.6 arcsec/count 
quantization level is about 500°/hr. 


CONCLUDING REMARKS 

It has been shown that for step failures of a given magnitude, the faulty 
sensor can be identified. For lower magnitude step failures the tetrad strat- 
egy does not identify the faulted sensor properly; however, the confidence 
algorithm indicates when the solution is suspect. 

As has been shown in the development, four sensors are necessary for 
detecting (by parity) a failure. Additional information is needed in order 
to isolate which one of the four has failed. This study investigated the 
feasibility of using prediction techniques for gaining the required informa- 
tion for Identifying sensor failures in the tetrad configuration. 

An interesting by-product of this study was the problem of generating 
clean parity signals for the detection algorithm from experimental data. 
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Although the Integrating rate gyro sensors were supposedly of inertial-grade 
quality, considerable computational effort was required to obtain clean enough 
signals for this study. 

These problems suggest that using parity residuals for detection and 
Isolation in pentad and hexad inertial reference systems requires consider- 
able care in the calibration of the units. The instrument's output also lias 
to be relatively free of noise with low quantization levels if parity resid- 
uals are to be useful in detecting small bias-offset-type failures with very 
small probability of false alarms. 


APPENDIX 


EXPERIMENTAL FACILITY AND DATA USED IN STUDY 


The tetrad FO-FS strategy was tested with real sensor data generated on 
the facility shown in figure 10. 


Facility Description 

This facility was developed at Ames Research Center for testing redun- 
dancy management concepts applicable to strap-down inertial sensor systems. 

The facility includes a three-axis gimbaled table; a laboratory strap-down, 
variable angle, hexad Inertial sensor assembly; a minicomputer; a digital 
magnetic tape recorder; and a line printer and other peripherals required for 
conveniently testing redundancy management concepts and strategies. The mini- 
computer is used for time-division multiplexed data acquisition and for driving 
the table. 

The attitude table is an orthogonal three-axis, gimballed system controlled 
by an electro-hydraulic servo whose attitude Inputs can be derived from typical 
V/STOL flight profiles prerecorded on magnetic tape, or by a function gener- 
ator with sine wave, triangular wave, or ramp outputs at selected frequencies. 
Monitoring of gimbal angles is accomplished with high resolution linear 
Inductosyn digital shaft encoders whose angular resolution is 2.5 arcsec. 

The table is mounted on a concrete base 1.5 m (5 ft) In depth, which is in 
turn supported by 30.5 m (100 ft) pilings. 

The variable angle hexad strap-down inertial sensor assembly shown in 
figure 11 is mounted on the attitude table in an ortho-skew tetrad configura- 
tion, with three sensor (gyro and accelerometer) pairs orthogonal to each 
other, and a fourth sensor pair skewed to a position which has equal angles 
to the three orthogonal axes. The gyros are Hamilton Standard Model RI1139 
slngle-degree-of-freedom, pulse-rebalanced, rate-integrating wheel type, and 
the Singer-General Precision Model 2401 accelerometers are pulse-rebalanced, 
single-axis, pendulous devices. All the sensors were surplused from the 
Lunar Module Abort Guidance System of the NASA Apollo program. 

The data acquisition system, schematically shown in figure 12, consists 
of 14 time-division multiplexed channels which are used to transmit both in- 
ertial sensor data and gimbal axis angular-position Information from digital 
shaft encoders to the minicomputer for reprocessing. The formatted data are 
then transmitted to a digital magnetic-tape recorder and also to a line 
printer. The data acquisition system includes both A-D converter and D-A 
converter units for outputing to analog recorders or inputting from function 
generators or conventional tape. 

Sensor data and digital shaft encoder data are transmitted to the com- 
puter via the multiplexer every 128 msec. The computer transmits these raw 
data to the digital magnetic-tape transport unit for use with off-line 
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redundancy management experiments, and also unpacks and scales the data for 
use with four different analysis programs. The data analysis programs in 
the minicomputer perform the following functions: parity-error computation, 

sensor cumulative count average, gyro error detection and a comparison of 
sensor and shaft encoder angular position information. The output of each 
program can be displayed on a line printer for quick- look analysis. 


Inertial Sensor Calibration 


Output signals of gyros and accelerometers must be compensated for non- 
zero biases, non-unit scale factors, axis misalignments and other effects in 
order to be made useful in either a flight control or navigation system. 
Calibration was accomplished using static and dynamic methods. In a station- 
ary condition, gyros measure Earth's rotation rate and accelerometers measure 
gravitational reaction. Wheel gyro output is affected by gravity because of 
wheel mass unbalance. The calibration procedure was formulated by a measure- 
ment model which related the estimated input and measured sensor output 
through the compensation parameters. Equations (Al) and (A2), which are the 
same as equations (4) and (5) but repeated here for the reader's convenience, 
Illustrate the measurement models: 


Attitude gyro measurement model: 

t 


A0i(t) = / (b-L + S ± • a + Mjl • F)dx + q ± + r ± 


t-A 


Accelerometer measurement model: 


Av^ (t) 



F)dx + q^ d* 



(Al) 


(A2) 


Compensation parameters are: biases (b^) , scale factor and alignment 

vectors (S^) and, for the gyros, mass unbalance vectors (M^) . Inertial 
sensor outputs and three-axis table attitude angles are recorded for a number 
of prescribed static orientations. A standard least-squares procedure is 
used to determine those compensation parameter values which minimize the sum- 
squared difference between estimated and observed sensor outputs. Measurement 
noise and quantization effects are accommodated by averaging the sensor out- 
puts over a 20-min interval at each static orientation. 


The scale factor and alignment vectors, S-p for the gyros are determined 
by a dynamic calibration procedure in which the attitude table is rotated 
through a given angle about each gimbal axis in sequence. Gyro outputs are 
approximately proportional to the component of rotation along the gyro's 
input axis. This relationship permits calibration of using a finite 

rotation sequence. The two methods are shown schematically in figure 13 and 
the resultant calibrated compensation parameters are shown in table 5. 
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TABLE 5.- SENSOR COMPENSATION PARAMETERS 



Bias, b^ 
(counts) 

Scale factor-alignment vector, 
(counts/deg or counts/g) 

Parity 

coefficients 

Gyro No. 1 (a) 

-0.36435 

10.30 -0.61 

-1117.97 - 0.66035 

Gyro No. 2 (0) 

-.15447 

40.40 1123.62 

-1.02 - .63636 

Gyro No. 3 (y) 

.01053 

-1090.40 35.06 

-92.47 + .6601 

Gyro No. 4 (1) 

.13842 

752.35 691.46 

-667.86 1.0000 

Accel No. 1 (a) 

1.24 

-5.40 2.02 

-1290.55 - .57213 

Accel No. 2 (0) 

-18.09 

39.94 1311.82 

-27.87 - .55180 

Accel No. 3 (y) 

.54 

1258.06 -33.17 

-133.36 - .58508 

Accel No. 4 (1) 

-7.96 

755.01 705.61 

-831.77 1.0000 


Note: The gyro mass unbalance compensation parameters used In this paper were 

zero. 


The tetrad parity residual, e^, of equation (A3) is a direct measure of 
the "goodness" of the calibration. 

e 5 = - ccn^ - 0m 2 - yntj (A3) 


If the estimated bias of any one sensor is in error, the average parity 
residual will be proportionately offset from zero. The parity coefficients 
u, 0, and y, which are computed from the estimated scale factor and alignment 
vectors S.^ , must be very accurate or the gyro parity residual will fluctuate 
wildly in the presence of large angular rates. The parity residual bias error 
determines the failure-detection sensitivity and the minimum isolatable failure 
level. These derived parity coefficients are shown in table 5. 


Tetrad Experimental Data 

Figures 14-16 show the actual gyro data used to evaluate the tetrad 
FO-FS algorithms. The gyros were mounted on the motion table which was com- 
manded to undergo oscillatory angular motion about two axes-roll and pitch. 
The gyro output shown in the figures represents digitized integrated angular 
rate sensed as a result of this motion. 
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The apparently continuous curves shown in the figures are really discrete 
points connected artificially by the plotting routine. The discrete points 
are sensed angular rate Integrated over one data frame (0.128 sec) by each 
gyro. Oscillatory angular motion was selected as a convenient way to intro- 
duce variable, flight-similar angular rates to be measured by the gyros. The 
period of the commanded oscillatory motion was chosen as 5-10 sec for roll and 
100 sec for pitch. Amplitudes of the motion were chosen as 4° in roll and 
20° in pitch. This motion was well within the capabilities of the table and, 
though not a perfect simulation of aircraft motion, developed rates and rate 
variations which might be encountered in aircraft flight. Irregularities in 
the table drive system produced Irregular rate variations, especially notice- 
able in the pitch (outer gimbal) axis, which degraded performance of the 
failure isolation algorithms. These irregular rate variations are believed 
to pose a more severe test of the failure isolation algorithms than real air- 
craft motion would pose. 

Gyro data from four different regions (I, II, III, and IV) of the data 
displayed in figures 14-16 were used to test the algorithms. Shown on each 
figure is the parity residual computed from the raw sensor data and the sensor 
compensation parameters from calibration. The parity residuals showed no 
observable bias, a noise level of between 24.5°/hr and 49°/hr and a motion 
dependency (e.g., scale factor misalignment or mass unbalance error) of about 
1 %. 


Region I, shown in figure 14, represents a roll oscillation of 0.1 Hz and 
no pitch or yaw motion. The pitch gyro, whose axis was not perfectly orthog- 
onal to the roll axis, exhibits a small component of roll rate while the 
skewed gyro exhibits a sizable component of roll rate. The rolling motion 
includes both (commanded) and high (resultant) frequency components. The peak 
roll was approximately 4000°/hr. 

Region II, shown in figure 15, includes a rolling oscillation similar to 
that of Region I, a pitch rate with high frequency jitter, and no yaw motion. 
Region III, also shown in figure 15, includes low- and high-frequency varia- 
tion in pitch and roll and no yaw motion. The maximum pitch rate was about 
6400 °/hr. Region IV, shown in figure 16, includes a linearly changing roll 
rate from about +7800°/hr to -8300°/hr, a relatively constant pitch rate of 
1900°/hr, and no yaw motion, Each region was about 3-sec long and provided 
20 separate data frames. 


27 



REFERENCES 


1. Eberlein, A. J. ; and Savage, P. G. : Strapdown Cose Trend Study and 

Forecast. NASA CR-137585, Oct. 1975. 

2. Gilmore, J, P. : A Non-Orthogonal Gyro Configuration. MIT MS Thesis, 

Jan. 1967. 

3. Musoff, Howard: SIRU Utilization, Volume I, Theory, Development and Test 

Evaluation. R-747, The Charles Stark Draper Laboratory, Mar. 1974. 

4. Gilmore, J. P. ; and Cooper, R. J. : SIRU Development-Final Report. R-746, 

The Charles Stark Draper Laboratory, July 1973. 

5. Wilcox, J. C. : Competitive Evaluation of Failure Detection Algorithms 

for Strapdown Redundant Inertial Instruments. TRW Report No. 18313- 
6004-RU-00, April 1973 (NAS8-27335) . 


28 







Figure 3.- Pseudosensor strategy 
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Figure 4.- Constrained-fit strategy. 
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Figure 5.- Root-roean-square error in prediction of the pseudosensor's output 
vs number of data frames in the isolation interval (5-point, first-order 

fit in region I). 
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Figure 6.- Detection interval vs step failure level for 980°/hr summed parity 

residual detection threshold. 
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Figure 7.- Confidence measures rejection of successful identifications by 
tetrad FO-FS strategy (for fit interval 5 points and fit order 1) vs 

failure step level. 


35 




SUCCESSFUL ISOLATIONS, percent 




I I N* 

E3 R * STEP FAILURE LEVEL 



01234 1234 1234 

ISOLATION INTERVAL, DATA FRAMES 


I Igure 8.- Frames required to detect and isolate sensor failure (isolation 
interval) for step failures 490°/hr, 980°/hr, and 1960°/hr. 
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Figure 9.- Successful identification level vs sensor quantization (determined 

from noise-free simulated gyro data). 
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Figure 10. 


Facility for testing strap-down inertial systems 
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Figure 11.- Strap-down, variable angle, hexad inertial sensor assembly. 
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Figure 13.- 


Information flowgraph for static and dynamic calibration. 
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Figure 16.- Attitude gyro outputs and parity residual for 0.2-hz pitching 

motion. 
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